In cPanel the ClamAV executables are installed in /usr/local/cpanel/3rdparty/bin/. Historically symlinks have been created in /usr/local/bin to help use on the command line. As of 11.40, new ClamAV installations do not create symlinks in /usr/local/bin. If the symlinks are present (from a previous or incomplete installation) the installation treats the opperation as an “upgrade”, and re-creates them to the path of the install.

If you are having this problem, and have already installed ClamAV through WHM, check to make sure that your executables are here:

# ls -lah /usr/local/cpanel/3rdparty/bin/*clam*

If they are, make sure that there are no current ClamAV files in /usr/local/bin:

# ls -l /usr/local/bin/*clam*

If both of those check out, you can create symlinks in /usr/local/bin to make scanning your server easier.